Most of the examples of XSS, I have seen examples of websites that get its parameter tampered through url query parameter. For example:
But if the application receives its payload not through url query parameter but through Post request body, how can attacker lure victim to perform xss by simply providing url to click? You can definitely, tamper with post body values by inserting code, but that will not be considered as XSS, since that is usually done in apps like fiddler or curl which does not run response code. So how can xss occur in this applications. As far as I understand xss does not persist data on the server, but rather affects the user who is making that request.